> ## Documentation Index > Fetch the complete documentation index at: https://docs.altrum.ai/llms.txt > Use this file to discover all available pages before exploring further. # Virtual keys > Create the keys your applications and people use to send requests through the AI Gateway, and attach them to AI systems. A virtual key is what an application or a person sends to the AI Gateway instead of a provider's API key. It tells Altrum who is calling and which rules apply. Because it is not a provider credential, a leaked key can be revoked in Altrum without touching your provider accounts. ## Three kinds of key | Kind | Belongs to | Use it for | Created by | | - | - | - | - | | Organization key | Your organization | Traffic you have not tied to an AI system yet | Owners and admins | | AI system key | One AI system | An application that is a registered AI system | Owners and admins | | Personal key | One person | Your own coding agent or experiments | Any member, when an admin allows it | Each key follows the rules of what it belongs to: the guardrails, budget, rate limit, model access and cache of the AI system, or of the organization for organization and personal keys. A key whose owner has no live guardrails shows **Unguarded**: nothing checks its requests until guardrails are applied. A key can also have its own budget, rate limit, providers and models. An expiry date is optional. A key with no providers chosen can use every provider your organization has stored a credential for. ## Create a key Open **AI Gateway**, then **Virtual keys**, and choose **Create key**. Name it, and optionally describe it, set when it **Expires** (never, in 30 or 90 days, or on a date), choose its **Providers and models**, its **Limits** and the **MCP tools** it may use. When your organization also uses Altrum's governance, you can make it an AI system's key from the start by choosing the **AI system**. Copy the key when it is shown: it is shown once and cannot be shown again. The list shows only its last four characters. Every key starts with `sk-alt-`. | Setting | Limit | | - | - | | Name | 1 to 100 characters | | Description | Up to 300 characters | | Providers | 1 to 6, each listed once, each with a weight from 0 to 1000 | | Allowed or blocked models | Up to 200 per provider, each up to 200 characters | | Budget | More than 0 and up to 10,000,000 US dollars, per hour, day, week or month | | Rate limit | 1 to 1,000,000,000 requests, tokens or both, per minute, hour or day | ## Send it Give the key to your SDK as its API key, and it sends it as a bearer token or in the header it always uses. You do not change your code beyond the base URL and the key. See [Authentication](/api-reference/authentication.md) and [SDKs](/ai-gateway/sdks.md). A key that cannot be used is refused before anything reaches a provider: | Status | Code | Message | | - | - | - | | 401 | `virtual_key_required` | `virtual key is required. Send it as Authorization: Bearer sk-alt-..., or in the x-api-key or x-alt-vk header.` | | 401 | `access_not_found` | `access not found. The provided credential does not exist or has been revoked.` | | 403 | `access_blocked` | `virtual key is inactive` (switched off) or `virtual key has expired` | | 403 | `ai_system_inactive` | `this AI system is not live. An owner, an admin, a Governance Lead or the AI system's owner can take it live in Altrum.` An AI system's keys work only while it is **Live** (see [Lifecycle](/ai-systems/lifecycle.md)). | ## Attach an organization key to an AI system When you register the AI system an organization key's traffic belongs to, attach the key to it with **Attach to an AI system** in the key's menu (shown once your organization has AI systems). From the next request, the AI system's guardrails, budget, rate limit and cache apply. Earlier requests in the log keep their organization attribution. A key can be attached once. It cannot be moved to another AI system or detached, and a personal key cannot be attached. > [!WARNING] > > An AI system's keys work only while it is **Live**. Attach a key to an AI system in Draft, In review or Approved and its requests are refused from the next one, with `ai_system_inactive`, until the AI system goes live. The dialog warns you when you pick one. To avoid an outage, attach the key once the AI system is live. [Discover](/discover.md) lists the keys whose traffic belongs to no AI system, and attaches them from there: to an AI system you register from their traffic, or to one you already have. ## Personal keys An admin allows personal keys under **AI Gateway**, **Settings**, **Access** and sets what **Each new personal key starts with**: a budget, a request limit and the **Allowed models**. Until they do, **My keys** says: `Your organization has not turned on personal keys. Ask an owner or admin to turn them on.` The defaults are copied when a member makes a key, so changing them later does not change keys that exist. Admins can tighten any personal key. A personal key is still held to the organization's own budget and limits. A personal key is also how Altrum knows who you are when an MCP tool needs your own account. See [MCP tools](/ai-gateway/mcp.md). When a member is removed from the organization, or their account is disabled, their personal keys stop working. They are switched off, not deleted, and enabling the account again does not switch them back on: the member makes new ones. ## When a key was last used **Virtual keys**, **My keys** and an AI system's **AI Gateway** tab show **Last used** for each key: the latest request or tool call made with it, or **Never**. A key nobody uses any more is one to revoke; an [access review](/access-reviews.md) lists every key with it, its spend over 90 days and what looks wrong with it. ## Rotate and revoke Each key's menu has **Edit**, **Rotate**, **Switch off** (or **Switch on**), **Revoke** and, for an organization key, **Attach to an AI system**. **Rotate** issues a new value for the same key, keeping its settings and history, and shows it once: "A new value is made and shown once. The old value stops working, so update everything that uses it." **Switch off** refuses the key's requests until it is switched on again. **Revoke** stops a key for good: "The key stops working straight away and cannot be brought back. Its requests stay in the log." A member can rotate and revoke their own personal keys under **AI Gateway**, **My keys**; owners and admins can do the same for any key. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.